Retrieve detailed information about multiple Malware Report notifications with data grouped into UI-ready panels.
What this endpoint does
Retrieves detailed panel data for up to 250 Malware Report playbook alerts in a single request. These alerts fire when sandbox analysis matches monitoring rules. Use Playbook Alerts: Search with category: ["malware_report"] to obtain alert IDs. For a single alert, use Playbook Alerts: Malware Report Detail.
Response data
Returns an array of alert objects. Each contains matched file hashes with SHA-256, risk and sandbox scores (1–10), malware family tags, and report IDs usable with the Sandbox Reports API. The spec schema omits log panels from its properties, but panel_log and panel_log_v2 are both present in real responses when "log" is requested — prefer panel_log_v2.